PT-2026-99382 · Froxlor · Froxlor

Skeletonsec

·

CVE-2026-100711

·

Published

2026-09-26

·

Updated

2026-09-26

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12
Description The software fails to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. This allows attackers who possess hijacked sessions, valid API keys, or 2FA trust tokens to maintain full account access even after a password rotation, effectively bypassing incident response measures.
Recommendations Update to version 2.3.12 or later.

Exploit

Fix

Insufficient Session Expiration

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-100711
GHSA-57WV-G7M3-HMFF

Affected Products

Froxlor